Feedback Coding Enables Inference-Time Covert Agentic Communication
Abstract
As large language models (LLMs) are increasingly used to automate digital interactions, users can leverage LLM-generated text as cover for covert communication within seemingly benign conversations. Existing LLM steganography, however, is predominantly white-box, requiring the sender and receiver to share the cover statistics, typically through access to the model weights and prompt. Black-box schemes remove this requirement by allowing the receiver to operate solely on the generated text, but current approaches rely on fixed-length, open-loop watermarking techniques that suffer from high decoding error rates under variable-length token generation. We recast black-box LLM steganography as a sequential communication problem with causal, noiseless feedback: every generated token is observed by both parties and can guide subsequent embedding. Based on this perspective, we introduce \textbf{B}urnashev \textbf{A}daptive Posterior \textbf{M}atching (BAM), a feedback-coding scheme that combines posterior matching with a decode-and-confirm phase. The design is inspired by classical information-theoretic feedback-coding principles, while its security is established through a cryptographic reduction proof. Across three open-weight language models, we demonstrate that BAM attains 0-0.1\% empirical message error on an 8-bit payload in around 50 tokens, across 1000 trials, versus 10-17\% for the strongest black-box baseline at comparable length. Building on the proposed steganography algorithm, we demonstrate the feasibility of an end-to-end communication protocol that achieves high communication rates across multiple conversational settings.
Related
- Communication Advantages from Quantum Dense Network Coding
- Masked Neural Detection for Run-Length-Limited Channel Coding in Molecular Communication
- MaskCode: Mask Transformer for Feedback-Assisted Coding With Linear Block Codes
- Variable-Length Feedback Coding With Universal Decoding and Bandit Channel Selection
- CausalSmith: A Formally Grounded, Self-Improving Agentic Framework for Automated Research in Causal Inference
BibTeX
@misc{guo2026feedback,
title = {{Feedback Coding Enables Inference-Time Covert Agentic Communication}},
author = {Sidong Guo and Sajani Vithana and Atefeh Gilani and Lalitha Sankar and Oliver Kosut and Flavio P. Calmon},
howpublished = {arXiv},
year = {2026},
month = sep,
doi = {10.48550/arxiv.2609.24994},
eprint = {2609.24994},
archivePrefix = {arXiv},
url = {https://arxiv.org/abs/2609.24994},
note = {CC BY 4.0},
}
RIS
TY - UNPB
TI - Feedback Coding Enables Inference-Time Covert Agentic Communication
AU - Sidong Guo
AU - Sajani Vithana
AU - Atefeh Gilani
AU - Lalitha Sankar
AU - Oliver Kosut
AU - Flavio P. Calmon
PY - 2026
DA - 2026/09/21
PB - arXiv
DO - 10.48550/arxiv.2609.24994
UR - https://arxiv.org/abs/2609.24994
AB - As large language models (LLMs) are increasingly used to automate digital interactions, users can leverage LLM-generated text as cover for covert communication within seemingly benign conversations. Existing LLM steganography, however, is predominantly white-box, requiring the sender and receiver to share the cover statistics, typically through access to the model weights and prompt. Black-box schemes remove this requirement by allowing the receiver to operate solely on the generated text, but current approaches rely on fixed-length, open-loop watermarking techniques that suffer from high decoding error rates under variable-length token generation. We recast black-box LLM steganography as a sequential communication problem with causal, noiseless feedback: every generated token is observed by both parties and can guide subsequent embedding. Based on this perspective, we introduce \textbf{B}urnashev \textbf{A}daptive Posterior \textbf{M}atching (BAM), a feedback-coding scheme that combines posterior matching with a decode-and-confirm phase. The design is inspired by classical information-theoretic feedback-coding principles, while its security is established through a cryptographic reduction proof. Across three open-weight language models, we demonstrate that BAM attains 0-0.1\% empirical message error on an 8-bit payload in around 50 tokens, across 1000 trials, versus 10-17\% for the strongest black-box baseline at comparable length. Building on the proposed steganography algorithm, we demonstrate the feasibility of an end-to-end communication protocol that achieves high communication rates across multiple conversational settings.
ER -